# CVE-2026-8328: Python CPython SSRF in ftplib.ftpcp function

Source: https://junglewise.ai/threats/cve-2026-8328-python-cpython-ssrf-in-ftplib-ftpcp-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-8328 · Severity: info · CVSS 5.9 · Published 2026-05-13

A vulnerability exists in the Python standard library's FTP module, which is used by developers to transfer files between servers. A malicious FTP server could trick a client into connecting to a different, unintended computer or service on the network. This could be used to bypass network security controls or perform unauthorized actions on internal systems.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-8328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8328 being exploited in the wild.

**How severe is CVE-2026-8328?** Informational severity, with a CVSS score of 5.9, published 13 May 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.12, 3.13, 3.14, 3.15.

**Is there a fix for CVE-2026-8328?** A patch was published on 2026-05-10: Initial fix committed to CPython repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8328 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8328?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ftpcp() function in Lib/ftplib.py was found to be vulnerable to Server-Side Request Forgery (SSRF) because it calls parse227() directly and trusts the IP address provided by the source FTP server in response to a PASV command. This bypasses a previous fix (CVE-2021-4189) that was applied to the makepasv() function but missed in ftpcp(). An attacker controlling a malicious source FTP server can provide an arbitrary IP address and port, which the client then passes to the target server's PORT command, causing the target server to initiate a data connection to the attacker's chosen destination. The fix ensures ftpcp() uses the source server's actual peer address instead of the self-reported address.

## Affected products

- Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15

## Timeline

- 2026-05-10: patched: Initial fix committed to CPython repository.
- 2026-05-13: disclosed: CVE-2026-8328 published.

## References

- [https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06](https://github.com/python/cpython/commit/5dadc64673ce875ebfb24163907777dae0f6ca06)
- [https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0](https://github.com/python/cpython/commit/7d95a1dc7382b55cba7fdd6a110336077584a4f0)
- [https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763](https://github.com/python/cpython/commit/bb3446dda6c49b32e67c11dbbbf221b40be00763)
- [https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d](https://github.com/python/cpython/commit/c88704431ea3248ca769384c13856330976fac1d)
- [https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9](https://github.com/python/cpython/commit/eac4fe3b2c77693790a5ef7dfab127c1fee81bf9)
- [https://github.com/python/cpython/issues/87451](https://github.com/python/cpython/issues/87451)
- [https://github.com/python/cpython/pull/149648](https://github.com/python/cpython/pull/149648)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)